From 46e39c8e14dc98045107cfb38af8cecb8a4773b0 Mon Sep 17 00:00:00 2001
From: Michael Vogt <michael.vogt@ubuntu.com>
Date: Fri, 8 Jan 2010 22:28:49 +0100
Subject: * French manpage translation update
* spot & fix various typos in all manpages
* German manpage translation update
* cmdline/apt-cache.cc:
- remove translatable marker from the "%4i %s\n" string
* buildlib/po4a_manpage.mak:
- instruct debiandoc to build files with utf-8 encoding
* buildlib/tools.m4:
- fix some warning from the buildtools
* apt-pkg/acquire-item.cc:
- add configuration PDiffs::Limit-options to not download
too many or too big patches (Closes: #554349)
* debian/control:
- let all packages depend on ${misc:Depends}
* share/*-archive.gpg:
- remove the horrible outdated files. We already depend on
the keyring so we don't need to ship our own version
* cmdline/apt-key:
- errors out if wget is not installed (Closes: #545754)
- add --keyring option as we have now possibly many
* methods/gpgv.cc:
- pass all keyrings (TrustedParts) to gpgv instead of
using only one trusted.gpg keyring (Closes: #304846)
* methods/https.cc:
- finally merge the rest of the patchset from Arnaud Ebalard
with the CRL and Issuers options, thanks! (Closes: #485963)
---
doc/examples/apt-https-method-example.conf | 21 +++++++++++++++++++++
doc/examples/configure-index | 12 ++++++------
2 files changed, 27 insertions(+), 6 deletions(-)
(limited to 'doc/examples')
diff --git a/doc/examples/apt-https-method-example.conf b/doc/examples/apt-https-method-example.conf
index 0067171bd..cc7889044 100644
--- a/doc/examples/apt-https-method-example.conf
+++ b/doc/examples/apt-https-method-example.conf
@@ -36,6 +36,8 @@
to access its content.
- The certificate presented by both server have (as expected) a CN that
matches their respective DNS names.
+ - We have CRL available for both dom1.tld and dom2.tld PKI, and intend
+ to use them.
- It somtimes happens that we had other more generic https available
repository to our list. We want the checks to be performed against
a common list of anchors (like the one provided by ca-certificates
@@ -56,10 +58,13 @@ Acquire::https::CaInfo "/etc/ssl/certs/ca-certificates.pem";
// Use a specific anchor and associated CRL. Enforce issuer of
// server certificate using its cert.
Acquire::https::secure.dom1.tld::CaInfo "/etc/apt/certs/ca-dom1-crt.pem";
+Acquire::https::secure.dom1.tld::CrlFile "/etc/apt/certs/ca-dom1-crl.pem";
+Acquire::https::secure.dom1.tld::IssuerCert "/etc/apt/certs/secure.dom1-issuer-crt.pem";
// Like previous for anchor and CRL, but also provide our
// certificate and keys for client authentication.
Acquire::https::secure.dom2.tld::CaInfo "/etc/apt/certs/ca-dom2-crt.pem";
+Acquire::https::secure.dom2.tld::CrlFile "/etc/apt/certs/ca-dom2-crl.pem";
Acquire::https::secure.dom2.tld::SslCert "/etc/apt/certs/my-crt.pem";
Acquire::https::secure.dom2.tld::SslKey "/etc/apt/certs/my-key.pem";
@@ -97,6 +102,22 @@ Acquire::https::secure.dom2.tld::SslKey "/etc/apt/certs/my-key.pem";
used for the https entries in the sources.list file that use that
repository (with the same name).
+ Acquire::https[::repo.domain.tld]::CrlFile "/path/to/all/crl.pem";
+
+ Like previous knob but for passing the list of CRL files (in PEM
+ format) to be used to verify revocation status. Again, if the
+ option is defined with no specific mirror (probably makes little
+ sense), this CRL information is used for all defined https entries
+ in sources.list file. In a mirror specific context, it only applies
+ to that mirror.
+
+ Acquire::https[::repo.domain.tld]::IssuerCert "/path/to/issuer/cert.pem";
+
+ Allows to constrain the issuer of the server certificate (for all
+ https mirrors or a specific one) to a specific issuer. If the
+ server certificate has not been issued by this certificate,
+ connection fails.
+
Acquire::https[::repo.domain.tld]::Verify-Peer "true";
When authenticating the server, if the certificate verification fails
diff --git a/doc/examples/configure-index b/doc/examples/configure-index
index ced390447..b22603ed7 100644
--- a/doc/examples/configure-index
+++ b/doc/examples/configure-index
@@ -90,11 +90,6 @@ APT
TrustCDROM "false"; // consider the CDROM always trusted
};
- GPGV
- {
- TrustedKeyring "/etc/apt/trusted.gpg";
- };
-
// Some general options
Ignore-Hold "false";
Clean-Installed "true";
@@ -176,7 +171,10 @@ Acquire
Source-Symlinks "true";
PDiffs "true"; // try to get the IndexFile diffs
-
+ PDiffs::FileLimit "4"; // don't use diffs if we would need more than 4 diffs
+ PDiffs::SizeLimit "50"; // don't use diffs if size of all patches excess
+ // 50% of the size of the original file
+
// HTTP method configuration
http
{
@@ -308,6 +306,8 @@ Dir "/"
SourceParts "sources.list.d";
VendorList "vendors.list";
VendorParts "vendors.list.d";
+ Trusted "trusted.gpg";
+ TrustedParts "trusted.gpg.d";
};
// Locations of binaries
--
cgit v1.2.3
From c8e572e3cf36209f3693ce83c47ebce02be9fb99 Mon Sep 17 00:00:00 2001
From: Michael Vogt <michael.vogt@ubuntu.com>
Date: Sat, 9 Jan 2010 21:19:03 +0100
Subject: * apt-pkg/deb/debindexfile.cc, apt-pkg/pkgcachegen.cc: - add debug
option Debug::pkgCacheGen - merge fix for apt-get source pkg=version
regression (closes: #561971)
---
doc/examples/configure-index | 1 +
1 file changed, 1 insertion(+)
(limited to 'doc/examples')
diff --git a/doc/examples/configure-index b/doc/examples/configure-index
index b22603ed7..d46679998 100644
--- a/doc/examples/configure-index
+++ b/doc/examples/configure-index
@@ -383,6 +383,7 @@ Debug
pkgProblemResolver::ShowScores "false";
pkgDepCache::AutoInstall "false"; // what packages apt install to satify dependencies
pkgDepCache::Marker "false";
+ pkgCacheGen "false";
pkgAcquire "false";
pkgAcquire::Worker "false";
pkgAcquire::Auth "false";
--
cgit v1.2.3